Health Marketing Compliance News: October 2026

The biggest health marketing compliance changes between September 17 and October 26, 2026 were Microsoft's 18+ rule for healthcare ads (Microsoft), Meta's on-device conversion setting and its updated terms, effective November 20 (Meta; terms), Meta's rename of "full control" to "full access" (Meta), an FDA peptide notice sent to OMB, where DEA's telemedicine rule is still pending (FDA; DEA), California's SB 690 (bill), and a Washington Supreme Court ruling on a hospital's Meta Pixel (opinion). This roundup is from Curve Compliance, which sends healthcare conversions to ad platforms server-side and signs a BAA on every plan.

Book a call. Not sure which of these touches your campaigns? Curve's team will review what your site sends to Meta, Google and TikTok with you and show what's likely triggering a flag. Book a call with Curve.

October 2026 at a glance

Date	What changed	Who it affects	Source
Oct 5	Microsoft: healthcare ads "must target users ages 18+"	Microsoft health advertisers	Microsoft
Seen Oct 13	Google rewords its suspension sentence; same rule	Pharmacy and Misrepresentation cases	Google
Seen Oct 15	Meta renames "full control" to "full access"	Meta business portfolio admins	Meta
Seen Oct 15	Meta's Conversions API reference no longer lists opt_out	Meta server-side senders	Meta
Seen Oct 23	Meta: on-device conversion measurement on by default	Meta advertisers with login sites	Meta
Oct 19	Safari 27 blocks identity resolution scripts	Sites with third-party email ID scripts	WebKit
Nov 20	Meta Commercial Terms update takes effect	All Meta advertisers	Meta
Since Aug 25	DEA telemedicine final rule pending at OIRA	Controlled-medication telehealth	OIRA
Oct 14	FDA peptide compounding notice sent to OIRA	Peptide clinics	OIRA
Oct 20	FDA final guidance: companion app content treated as promotional	Drug makers with patient apps	FDA
Oct 5	FTC letters on incomplete fee disclosures	Hospitals and large providers	FTC
Oct 8	OCR right of access settlement	HIPAA covered entities	HHS
Sept 30	California SB 690 signed; effective Jan 1, 2027	Sites facing CIPA suits	leginfo
Coming Jan 1, 2027	AB 566 (signed Oct 2025): browsers must offer an opt-out signal	Sites with California visitors	leginfo
Oct 8	Seattle Children's pixel claim dismissal affirmed	Hospitals with ad pixels	Opinion
Hearing Dec 1	CVS and Criteo class settlement	Pharmacy sites with ad tech	Settlement
Oct 14	Supreme Court hears a video privacy case	Sites with video and pixels	Docket

Ad platforms

October 5: Microsoft's 18+ rule for healthcare ads

Microsoft's Healthcare and Pharmaceutical policy ("This page was last updated on Oct 5, 2026") now ends its general requirements with: "Advertising must target users ages 18+." Those requirements cover "advertisers promoting pharmacy, health care services, or wellness products" (Microsoft policy).

What it means for your ads or tracking: Check the age setting on every health, pharmacy and wellness campaign. The same section bars "targeting consumers based on sensitive health information." For disapprovals, see Microsoft telehealth disapprovals.

Seen October 13: Google rewords its suspension sentence

By October 13, Google's Misrepresentation policy had split one sentence into three: "If we find violations of this policy, your Google Ads accounts will be suspended. This suspension occurs upon detection and without prior warning. You will not be allowed to advertise with Google Ads again." Two sections of the Healthcare and medicines policy, including Unauthorized pharmacies, now read the same (Misrepresentation; Healthcare and medicines).

What it means for your ads or tracking: Only the wording changed; suspension still comes without warning. See Google Unacceptable business practices and a suspended Google Ads account.

Seen October 15: Meta renames "full control" to "full access"

Meta's permissions article now says "People with full access (formerly full control) can manage everything in the business portfolio" (Meta Business Help). It appeared between our October 13 and October 15 checks.

What it means for your ads or tracking: Older guides and notices say "full control"; it is the same level. Meta also says "People with apps and integrations permissions (formerly the developer role) can set up the Conversions API." For a blocked portfolio, see business portfolio restricted and Business Support Home account status.

Seen October 15: Meta's Conversions API reference no longer lists opt_out

Meta's server event parameters page no longer lists the optional opt_out flag (current page). An archived September 19, 2026 copy described it as "A flag that indicates we should not use this event for ads delivery optimization" (archived copy).

What it means for your ads or tracking: If your server events set opt_out, confirm with Meta how they are handled now. See Meta Conversions API for healthcare.

Seen October 23: Meta describes on-device conversion measurement

Meta says "Measure conversions on customer devices is turned on by default." It "uses information they already shared with you (like an email) and temporary, non-identifying device information," and Meta says "No identifying customer information is shared with Meta" (Meta Business Help). To be eligible, "Your website must require people to log in to an account using an email or mobile phone number," and Meta adds: "It's on by default for eligible pixels, but you can turn it off at any time" (how to turn it on).

What it means for your ads or tracking: Meta also says "It's your responsibility to make sure your integration doesn't share prohibited information with Meta." If your patient portal or intake flow has a login and a Meta Pixel, check this setting in Events Manager. See Meta on-device conversion measurement for health sites and how to measure ads without tracking pixels.

October 19: Safari 27 blocks identity resolution scripts

WebKit says that "In our iOS, iPadOS, macOS, and visionOS 27 releases, Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking." It describes third parties that "invisibly collect your email address when you log in or sign up for a newsletter" and "create an opaque tracking ID permanently linked to your email address." WebKit says "The blocking is done on the domain level" and "First party personalization is not tracking" (WebKit blog).

What it means for your ads or tracking: The post names no companies. If a script on your site sends typed email addresses to a third party, ask its vendor whether Safari 27 blocks it. See Safari 27 and clinic ad tracking.

November 20: Meta's updated Commercial Terms take effect

Meta says "These updates will go into effect on November 20, 2026." The updated terms still bar information that "includes health, financial, biometrics, or other categories of similarly sensitive information," and add that advertisers authorize Meta "to use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents) and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl" the domains and pages tied to their products (updated terms; current terms).

What it means for your ads or tracking: The health data rule is unchanged. Expect Meta's automated tools to visit the pages your ads lead to, and check what those pages show. See Meta Business Tools Terms and health data.

Coming up: Meta's v26.0 changes apply "to all Marketing API versions on October 27, 2026," including "Poll components are no longer supported when creating or updating ads and creatives" (Meta changelog). Google says "Starting on October 30, 2026, we're updating our personalized advertising policy for YouTube inventory to allow for alcohol where locally permitted," and "We continue to prohibit targeting of health information related to alcohol under our Health sensitive interest category" (Google).

TikTok and ChatGPT Ads: In our checks, TikTok's healthcare ad policy and OpenAI's ad policies were unchanged from September 29 to October 26, 2026 (TikTok; OpenAI).

Regulators

Pending since August 25: DEA's telemedicine special registration rule

DEA's final rule on special registrations for telemedicine (RIN 1117-AB40) has been at OMB's Office of Information and Regulatory Affairs (OIRA) since August 25, 2026 (OIRA), listed as "Pending Review" (OIRA list). The current flexibilities rule "is effective January 1, 2026 through December 31, 2026" (Federal Register).

What it means for your ads or tracking: If you advertise telehealth that prescribes controlled medications, plan January campaigns around whichever rule applies after December 31; the final text is not public. See the DEA telemedicine rule guide and, for platform certification, LegitScript certification for healthcare ads.

October 14: FDA sends a peptide compounding notice to OIRA

FDA's notice "Interim Access Policy for Compounding Using Certain Peptides" (RIN 0910-ZD94) reached OIRA on October 14, 2026 (OIRA) and is "Pending Review" (OIRA list). It had not appeared in the Federal Register by October 26 (search).

What it means for your ads or tracking: Its terms are not public, so there is nothing new to apply yet. Ad platforms judge peptide ads by their own rules: see Meta peptide ad rejections, Google unapproved substances and peptide clinic ad boundaries.

October 20: FDA final guidance on prescription drug apps

FDA released final guidance on prescription drug apps on October 20, 2026. Its release says "In most cases, content a companion app displays to users will be treated as promotional material, consistent with how the FDA handles other drug advertising" (FDA release).

What it means for your ads or tracking: If an app tied to a prescription drug shows patients content, review it the way you review that drug's ads.

October 5: FTC letters to 24 healthcare services companies

The FTC's chairman "sent letters to 24 of the nation's largest healthcare services companies." A disclosure, the FTC says, "may still be deceptive if it is incomplete, such as when it omits physician or facility fees or covers only a portion of the expected course of care" (FTC release). FTC press releases from September 17 to October 26 show no new health privacy case (FTC).

What it means for your ads or tracking: If an ad quotes a figure for a procedure, check whether it omits physician or facility fees. Past cases: FTC health privacy actions.

October 8: OCR announces a right of access settlement

HHS's Office for Civil Rights settled with Shen Smiles, a dental practice, over "a failure to provide timely access to an individual's protected health information (PHI)" (HHS release). OCR also lists a September 17, 2026 Ambry Genetics agreement after a phishing attack (OCR agreements). OCR's HIPAA Privacy Rule final rule has been at OIRA since April 2, 2026 (OIRA).

What it means for your ads or tracking: Neither settlement involves marketing or tracking, and the Privacy Rule text is not public. For tracking, see the HHS tracking bulletin, annotated.

States

September 30: California SB 690 signed

California's Governor approved SB 690 (Chapter 976) on September 30, 2026. It says: "An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General." It reaches "any pending claim in an action commenced within two years before the operative date" (SB 690). It takes effect January 1, 2027 (Cal. Const. art. IV, sec. 8).

What it means for your ads or tracking: CIPA's other sections, including its wiretap section, still allow private suits. Full analysis: SB 690 and CIPA for health websites.

Coming January 1, 2027: AB 566 makes browsers offer an opt-out signal

AB 566, the "California Opt Me Out Act" (Chapter 465, approved October 8, 2025), becomes operative January 1, 2027. From then, a business may not maintain a browser that lacks a consumer setting to "send an opt-out preference signal" (AB 566). California's Attorney General already tells consumers they may opt out "including via a user-enabled global privacy control" (CA AG).

What it means for your ads or tracking: More California visitors may send an opt-out signal. Check how your site and consent tool respond before January.

Courts

October 8: Washington Supreme Court rules in the Seattle Children's pixel case

In Baker v. Seattle Children's Hospital, No. 104590-5, the court held that the Washington privacy act "excludes searches and clicks that generate an automated response from SCH's website" and affirmed dismissal of that claim. It said California's privacy act "likewise differs significantly from the WPA" (opinion).

What it means for your ads or tracking: It decides one Washington statute only. See the SB 690 guide and healthcare pixel lawsuits in 2026.

Final approval hearing December 1: CVS and Criteo settlement

A court-authorized notice covers Brewer, et al. v. CVS Pharmacy, Inc. and Criteo Corp. (Case No. CACE-26-008094) over data allegedly disclosed "to Criteo or other technology providers or third parties through technology embedded on any of the CVS Digital Properties." "Defendants deny that they violated any law." The final approval hearing is December 1, 2026 (settlement site).

What it means for your ads or tracking: The ad tech vendor is a defendant alongside the site. See healthcare pixel lawsuits in 2026.

October 14: Supreme Court hears Salazar v. Paramount Global

The docket for No. 25-459 records "Argued." on October 14, 2026 (docket). The case asks who counts as a VPPA "consumer" (question presented). Justice Kavanaugh cited amicus briefs noting suits "brought against every sector of the economy," including "health and fitness websites" (transcript).

What it means for your ads or tracking: A decision is pending. Sites with video pages and ad pixels should watch for it; see the SB 690 guide.

How Curve Compliance helps

Most of these changes come down to what your site sends to ad platforms. Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with a fixed list of fields for each. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Contact identifiers are off by default on Meta, Google Ads and TikTok, and Event Logs show what Curve sent and what each platform accepted.

When a platform flags something, Curve's team reviews what your site sends with you and shows what's likely triggering a flag. Curve's consent management holds back tracking until each visitor's choice allows it and honors Global Privacy Control in every region, and the free website scan lists the pixels and trackers on a page. Curve signs a BAA on every plan; setup is done by Curve's team.

Sources, checked October 26, 2026: Microsoft; Google Misrepresentation and Healthcare and medicines; Meta permissions; Meta CAPI parameters, current and archived; TikTok; OpenAI; OIRA list, 1117-AB40, 0910-ZD94 and 0945-AA00; Federal Register 2025-24123 and search; FTC release and press list; HHS release and agreements; SB 690; Cal. Const. art. IV; AB 566; CA AG; Baker opinion; CVS settlement; Salazar docket, question and transcript; WebKit; Meta on-device, setup, current terms, updated terms and v26.0 changelog; Google alcohol update; FDA release.

Frequently Asked Questions

What changed in health marketing compliance in October 2026?

Between September 17 and October 26, 2026, Microsoft began requiring healthcare ads to target ages 18+, Meta renamed "full control" to "full access" and described on-device conversion measurement, FDA sent a peptide notice to OIRA, and California signed SB 690 (Microsoft; Meta; Meta; OIRA; SB 690). Washington's top court ruled on a hospital pixel case (opinion).

Do Microsoft healthcare ads have to target people 18 and older?

Yes. Microsoft's policy, last updated October 5, 2026, says "Advertising must target users ages 18+" (Microsoft).

When do the DEA telehealth prescribing flexibilities end?

The current rule "is effective January 1, 2026 through December 31, 2026" (Federal Register). DEA's final rule has been pending at OIRA since August 25, 2026 (OIRA); see the DEA rule guide.

Is FDA changing its policy on compounded peptides?

FDA sent OIRA a notice, "Interim Access Policy for Compounding Using Certain Peptides," on October 14, 2026; it is pending and not public (OIRA).

Does California SB 690 end pixel lawsuits?

No. From January 1, 2027, only the Attorney General can sue a private actor under CIPA section 638.51 over website or app conduct; CIPA's other sections still allow private suits (SB 690).

What did the Supreme Court hear on October 14, 2026?

Salazar v. Paramount Global, a Video Privacy Protection Act case (docket). A decision is pending; talk to your counsel about video pages that carry ad pixels.

Talk to Curve Compliance

Book a call. Curve's team will review what your site sends to Meta, Google Ads and TikTok and set up server-side conversions under the BAA Curve signs on every plan, typically live in about a week. Book a call with Curve.